CVE-2026-63308

Helm through 4.2.3, fixed in commit ba6c9a2, contains a denial of service vulnerability in the Files.Lines template helper in pkg/engine/files.go that allows attackers to trigger an index out of range panic by including zero-length byte slices in chart files. Attackers can include empty files in Helm charts to cause deterministic render failures across template, install, upgrade, lint, and SDK Engine.Render operations.

CVSS 4.0

5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

CVSS 3.1

6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-29)

CWE

CWE-129

Published

2026-07-17

Modified

2026-10-29

Record from

the NVD, synced 2026-10-29

Affected

• helm:helm

References

• https://github.com/helm/helm/commit/ba6c9a29efa7bf9198dad6a5ec12b4fb30c96017
• https://github.com/helm/helm/issues/32279
• https://github.com/helm/helm/pull/32290
• https://www.vulncheck.com/advisories/helm-files-lines-denial-of-service-via-empty-chart-files

Check your stackJSON